Scopes

When you create an API key you can attach permission scopes. The server checks the key on every authenticated request (APIKeyGate).

Full access

An empty permissions list grants full access to every workspace API route the key can call. Prefer this for internal automation; use narrower scopes for least privilege.

Available scopes

Scope	Allows
certificates:read	GET on certificate, issue, correction, and request-form paths
certificates:write	Non-GET methods on those same paths
templates:read	GET on paths containing /template
templates:write	Non-GET methods on paths containing /template

Inference is path-based:

• Paths containing /template need templates:read or templates:write.
• Paths containing /certificate, /issues, /corrections, or /requests need certificates:read or certificates:write.
• Other authenticated workspace routes (for example /recipients) require a full-access key (empty permissions). A key limited to certificates:* alone cannot call them.

Missing permission returns 403 with code missing_permission.

Examples

Call	Scope needed
GET .../certificates	certificates:read (or full access)
POST .../certificates/{id}/issues	certificates:write (or full access)
POST .../certificates/{id}/send	certificates:write (or full access)
GET .../requests	certificates:read (or full access)
POST .../requests/{id}/approve	certificates:write (or full access)
GET .../corrections	certificates:read (or full access)
POST .../corrections/{id}/approve	certificates:write (or full access)
GET .../recipients	Full access only
Template draft / publish / fork	templates:read / templates:write (not in this v1 reference)